[dependabot]

Bumps symfony/http-foundation from 7.2.3 to 7.4.20.

Release notes

Sourced from symfony/http-foundation's releases.

v7.4.20

Changelog (symfony/http-foundation@v7.4.19...v7.4.20)

• bug #66251 Make session handlers non-serializable (@​mcdruid)
• bug #66078 Fix port stripping on IPv4-mapped IPv6 forwarded addresses (@​nicolas-grekas)

v7.4.19

Changelog (symfony/http-foundation@v7.4.18...v7.4.19)

• bug #66048 Remove the ambiguity that makes HeaderUtils::split() backtrack (@​nicolas-grekas)
• bug #66023 Fix IpUtils::anonymize() for non-canonical IPv4-mapped addresses (@​GabeSilvaDev)
• minor #65836 Fix hitting the PCRE size limit with many trusted host patterns (@​nicolas-grekas)
• bug #65775 Match paths with the DOTALL modifier (@​nicolas-grekas)

v7.4.18

Changelog (symfony/http-foundation@v7.4.17...v7.4.18)

• bug #65753 Combine trusted host patterns into a single regexp (@​nicolas-grekas)
• bug #65743 Encode the path in the X-Accel-Redirect header (@​Athorcis)
• bug #65729 Reject reserved characters in the cookie path and domain (@​nicolas-grekas)
• bug #65741 Reject invalid paths (@​nicolas-grekas)
• bug #65725 Fix parsing hosts and schemes in URLs (@​nicolas-grekas)
• bug #65684 Do not unmarshall values that SodiumMarshaller cannot decrypt (@​nicolas-grekas)
• bug #65683 Allow-list the values of the "X-Sendfile-Type" header (@​nicolas-grekas)
• bug #65682 Ignore session ids that are not usable as file names in MockFileSessionStorage (@​nicolas-grekas)

v7.4.17

Changelog (symfony/http-foundation@v7.4.16...v7.4.17)

• bug #65372 Declare create_sid() on session handlers (@​nicolas-grekas)
• bug #65252 Combine trusted host patterns into a single regexp (@​nicolas-grekas)

v7.4.16

Changelog (symfony/http-foundation@v7.4.15...v7.4.16)

• bug #65187 Treat a UriSigner expiration of 0 as a date, not as no expiry (@​sadiqk2)

v7.4.15

Changelog (symfony/http-foundation@v7.4.14...v7.4.15)

• bug #65023 Validate the characters allowed in a cookie path and domain (@​nicolas-grekas)
• bug #65022 Don't crash on a non-string signature in UriSigner (@​nicolas-grekas)
• bug #65020 Fix newline handling in server event fields (@​nicolas-grekas)
• bug #65001 Fix retry field being dropped across server event streams (@​nicolas-grekas)
• bug #64945 Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (@​Amoifr)
• bug #64783 Add additional IP ranges for RFC2544 and RFC5180 (@​thePanz)
• bug #64789 Add RFC5737 and RFC3849 to IpUtils::PRIVATE_SUBNETS (@​thePanz)
• bug #64701 Fix Absolute URL generation by ignore tel: mailto: and other app links (@​tomm1996, @​alexander-schranz)

v7.4.14

... (truncated)

Changelog

Sourced from symfony/http-foundation's changelog.

CHANGELOG

8.2

• Add five not-globally-reachable ranges to IpUtils::PRIVATE_SUBNETS: 192.0.0.0/24, 192.88.99.0/24, 224.0.0.0/4, 100::/64 and ff00::/8
• Add Response::cacheControl() to set the targeted cache directives defined by RFC 9213, e.g. CDN-Cache-Control
• Deprecate not passing an expiry to UriSigner::sign()
• Add the $defaultExpiration argument to UriSigner::__construct()
• Add argument $version to UriSigner::sign(), UriSigner::check(), UriSigner::checkRequest(), and UriSigner::verify() to bind a signed URI to a state token, folded into the signature
• Add ParameterBag::filterCallback() to filter a parameter value through a callback
• Reject a Cookie whose name uses the __Secure-/__Host- prefix when its attributes break the prefix contract
• Deprecate the Request::$trustedHosts property, it is never populated anymore
• Report the actual header value when the ResponseHeaderSame constraint fails
• Add ClearableSessionHandlerInterface for clearing all session data
• Add Request::getStructuredSuffixFormat() to resolve a mime type to the format of its structured syntax suffix, e.g. application/vnd.api+json to json

8.1

• Add BinaryFileResponse::shouldDeleteFileAfterSend()
• Deprecate setting public properties of Request and Response objects directly; use setters or constructor arguments instead
• Add SessionHasFlashMessage test constraint
• Response::__construct() now accepts a ResponseHeaderBag as its third argument
• ParameterBag::getInt() and ParameterBag::getBoolean() now throw UnexpectedValueException instead of silently returning 0/false when the value cannot be converted

8.0

• Drop HTTP method override support for methods GET, HEAD, CONNECT and TRACE
• Add argument $subtypeFallback to Request::getFormat()
• Remove the following deprecated session options from NativeSessionStorage: referer_check, use_only_cookies, use_trans_sid, sid_length, sid_bits_per_character, trans_sid_hosts, trans_sid_tags
• Trigger PHP warning when using Request::sendHeaders() after headers have already been sent; use a StreamedResponse instead
• Add arguments $v4Bytes and $v6Bytes to IpUtils::anonymize()
• Add argument $partitioned to ResponseHeaderBag::clearCookie()
• Add argument $expiration to UriSigner::sign()
• Remove Request::get(), use properties ->attributes, query or request directly instead
• Remove accepting null $format argument to Request::setFormat()

7.4

• Add #[WithHttpStatus] to define status codes: 404 for SignedUriException and 403 for ExpiredSignedUriException
• Add support for the QUERY HTTP method
• Add support for structured MIME suffix
• Add Request::set/getAllowedHttpMethodOverride() to list which HTTP methods can be overridden
• Deprecate using Request::sendHeaders() after headers have already been sent; use a StreamedResponse instead
• Deprecate method Request::get(), use properties ->attributes, query or request directly instead
• Make Request::createFromGlobals() parse the body of PUT, DELETE, PATCH and QUERY requests

... (truncated)

Commits

• 9d0761c Merge branch '6.4' into 7.4
• 8c9d7b5 Merge branch '5.4' into 6.4
• 27ba63f [HttpFoundation] Make session handlers non-serializable
• cf4e7f7 Merge branch '6.4' into 7.4
• cae1228 Stop referencing issues and pull requests in tests
• dd28f1d Merge branch '6.4' into 7.4
• 09c19c9 [HttpClient] Stop asserting the contents of IpUtils::PRIVATE_SUBNETS
• f4d98b9 Merge branch '6.4' into 7.4
• af993d9 Merge branch '5.4' into 6.4
• 8e115a8 [HttpFoundation] Fix port stripping on IPv4-mapped IPv6 forwarded addresses
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.